700Credit data breach (2025): what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

Date labels matter on this page. The intrusion was discovered in late 2025. Public scale reporting landed in December 2025. Class-action settlement activity and consumer claim notices continued into 2026 (claim deadline September 22, 2026; final approval hearing October 7, 2026 on the settlement administrator site). Read each date in context; do not treat 2026 settlement mail as the date of the hack.

What happened

700Credit, LLC (Southfield, Michigan) provides credit checks, identity verification, and related services for auto dealerships. The company detected a data incident on or about October 25, 2025, involving unauthorized access to its dealer-facing web application (commonly referenced as 700Dealer.com).

TechCrunch reported on December 12, 2025 that at least 5.6 million people had names, addresses, dates of birth, and Social Security numbers stolen, citing the company’s statements and Michigan Attorney General commentary. Other regulatory and press summaries put the nationwide figure around 5.6–5.8 million (some coverage citing Maine AG filings at about 5.8 million). Use the figure on your official notice if one differs. Headlines that round to “6 million” are approximate—not a separate confirmed census.

Public reporting described a third-party / API supply-chain path: a partner compromise earlier in 2025, then scraping of consumer records tied to dealer credit checks. Treat attack-path detail from secondary press as reporting, not as a full forensic report unless 700Credit confirms it in your letter.

Settlement timeline (separate from the breach date): A proposed $17.5 million class settlement in In re 700Credit Data Security Litigation (E.D. Mich., Case No. 25-cv-13747) describes the same October 25, 2025 discovery. The settlement administrator’s site listed a claim-form deadline of September 22, 2026, opt-out/object deadlines of September 8, 2026, and a final approval hearing on October 7, 2026. Those are litigation dates—not new breach dates. Check 700creditdatabreachsettlement.com or your mailed notice for current deadlines; this page is not legal advice and may lag court updates.

What data was exposed

Across company statements summarized by TechCrunch, AG commentary, and the settlement description of “Private Information,” impacted data has included some combination of:

• Names
• Addresses
• Dates of birth
• Social Security numbers
• Other personally identifiable information stored in 700Credit systems at the time of the incident (wording varies by notice)

Exact fields vary by person. Rely on your letter or settlement notice.

Breach details

This summary is compiled from public notices and reporting available when this page was last updated. Figures reflect what those sources report and may change as investigations continue. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by 700Credit; it reflects a publicly reported security incident.

For whether your information was involved and for official remediation offers, rely on notices from the organization named above (or from anyone they say will contact you) — not this page alone.

What to do now

Because Social Security numbers and dates of birth were named:

• Place a free credit freeze at Equifax, Experian, and TransUnion (and keep PINs somewhere safe). See how to freeze your credit.
• Consider a fraud alert if you are not ready to freeze; freezes are stronger for blocking new credit.
• Review AnnualCreditReport.com for unfamiliar accounts; report misuse at IdentityTheft.gov if needed.
• If you still have an unused monitoring activation code from 700Credit or the settlement notice, follow only the instructions on that official notice—not cold emails.
• Settlement claim rights are time-limited; if you received July/August 2026 settlement mail, read the administrator site for whether deadlines still apply as of today (claim form deadline listed as September 22, 2026).

Short checklist: first 48 hours after a data breach.

How this shows up on the open web

SSNs and DOBs do not appear as public people-search fields, but names and addresses do—and brokers already sell them. After a dealer-credit incident, scammers may combine leaked identifiers with what is already published about you. Run a free open-web scan to see which people-search and broker sites expose your personal data. Delist does not claim to have scanned 700Credit’s systems, dealer partners, or this incident’s files, and it does not remove dump copies.

SSN exposed in a car-dealer credit check—what first?

Freeze credit at all three bureaus. Review AnnualCreditReport.com for unfamiliar accounts. Use monitoring or settlement codes only from official notices. Settlement claim deadlines (e.g. September 22, 2026 on the administrator site) are separate from the October 2025 breach date. A free Delist scan checks open-web broker listings—not 700Credit’s files.

Frequently asked questions

When did the 700Credit breach happen?

700Credit detected the incident on or about October 25, 2025. Public reporting of the multi-million scale appeared in December 2025. Settlement claim mail and the October 7, 2026 final approval hearing are litigation dates, not a new hack date.

How many people were affected?

TechCrunch reported at least 5.6 million based on company statements. Other AG-linked press summaries cite about 5.6–5.8 million. Prefer the number on your official notice if it differs.

What is the $17.5 million settlement about?

It is a proposed class settlement for the same October 25, 2025 discovery (In re 700Credit Data Security Litigation). The administrator site listed claim, opt-out, and hearing deadlines in September–October 2026. Check that site or your mail for current dates; this page is not legal advice.

Can Delist remove my SSN from the 700Credit dump?

No. Nobody can reliably purge criminal copies of an SSN dump. Delist focuses on open-web people-search and broker listings.